Cursor expands malicious Claude Code extension scope to 2.1.312 and 2.1.313
Cursor now identifies modified Anthropic.claude-code 2.1.312 and 2.1.313 packages in its marketplace. They collect host details and install SSH persistence. Admin-rights restrictions often prevented remote login, but affected machines still need cleanup. Cursor says the attacker server is offline.
- Disclosed
- Oct 29, 2026
- Updated Oct 31, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- macOS and Windows users who installed modified 2.1.312 or 2.1.313 packages from Cursor’s extension marketplace
- Cursor · Claude Code · supply chain
- In the wild
- Yes
- Cursor confirms malicious distribution, not successful remote access on every host.
What happened
The modified package was not developed by Anthropic. Cursor’s notice identifies macOS arm64 and Windows x64 packages. SSH-service activation generally requires administrator rights, so remote login often failed; SSH keys, persistence and host-data reporting still require investigation. Scope is the identified distribution, not every Claude Code installation. L4 reflects a confirmed developer-tool supply-chain compromise.
Anthropic’s Felix Rieseberg says its systems and employee laptops were not compromised in this incident. David Dworken says 2.1.313 was never released through Open VSX, the Microsoft VS Code Marketplace or Anthropic’s official hosts; Anthropic skipped to 2.1.314 to distinguish its next release. These statements narrow distribution scope; they do not remove cleanup requirements for the malicious Cursor package.
Scope correction: Cursor’s October 30 update expands the earlier 2.1.313-only notice to include malicious 2.1.312 packages from its marketplace. Recheck both versions against the revised vendor hash tables; the version number alone does not make an official-channel 2.1.312 package malicious. The earlier 5,000-user upper bound is not restated in the revised notice.
Crime-scene timeline
Oct 29, 2026
Malicious package distributed and removed
Cursor gives an exposure window of about 2:27am–1:35pm PT and publishes its security notice dated October 29.
Oct 30, 11:30am PT
Cursor expands affected versions and updates IoCs
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Cursor security notice and complete IoC tablesPrimaryUpdated October 30 to identify both affected versions and revised hashes; does not establish compromise of Anthropic’s official distribution.
- Anthropic's Felix Rieseberg clarifies incident scopePrimary
- Anthropic's David Dworken clarifies release channelsPrimary